Electronic module assembly for controlling aircraft restraint systems

ABSTRACT

An electronic module assembly for controlling the deployment of one or more airbags in an aircraft includes a power source, a crash sensor configured to produce a signal in response to a crash event and an accelerometer that is configured to produce a signal in response to a crash event. A processor starts a timer upon detection of the signal from the crash sensor. When the processor receives a signal from the crash sensor, the processor is configured to determine if a signal has also been received from the accelerometer and if signals from both the crash sensor and the accelerometer indicate a crash event then the processor reads a memory associated with an inflator. The processor reads a timing value selected for the inflator and fires the inflator when the timer has a value equal to the timing value selected for the inflator.

TECHNICAL FIELD

The disclosed technology relates generally to vehicle restraint systems,and in particular to systems for controlling airbags used in aircraft.

BACKGROUND

Although airbags have been required safety equipment for U.S.automobiles since 1998, the technology is only recently becomingcommonplace on aircraft. Airbags are now often found in business andfirst class passenger seats of commercial airliners as well as in manypilot seats used in general aviation. In most airbag systems, acontroller is configured to receive a signal from a crash sensor and tosupply an electrical current to an inflator, which produces a gas toinflate an airbag. Controllers used in aircraft environments have uniquerequirements that complicate their design. First, the controllers inaircraft are battery powered and must be able to operate for 10 yearsplus 1 additional year without a change in batteries. Secondly, in orderto be cost effective, such controllers must be able to be used with avariety of seat configurations without hardware redesign.

SUMMARY

As will be described in further detail below, an electronic moduleassembly (EMA) for controlling a personal restraint system, such as anairbag in an aircraft, includes a processing unit that is powered by abattery power source. The processor is configured to receive a signalfrom a crash sensor in the event of a sudden deceleration. The signalcauses the processor to provide a firing signal to one or more inflatorsat a correct time so that an airbag or pre-tensioner activates at adesired time with respect to the location of a passenger who will hitthe airbag. In some embodiments, the processor stores the timingrequirements for a particular seat configuration with which theelectronic module is to be used.

In some embodiments, the electronics module assembly includes anaccelerometer in addition to the crash sensor that produces a signal inthe event of a sudden deceleration. The processor is configured todetermine if signals are being received from both the crash sensor andthe accelerometer before producing the firing signals to the inflators.In some embodiments, the accelerometer serves as check to confirm thatthe crash sensor is not malfunctioning. In some embodiments, the crashsensor provides a signal to one or more relays that are arranged toconnect a source of electrical power to the inflators.

In some embodiments, the electronic module assembly also includes anumber of test circuits to ensure that the batteries, the one or morerelays, the inflators and associated wiring are all operating asintended. In some embodiments, test circuits are also provided to ensurethat seat belts associated with the airbags are fastened beforeproducing the firing signals for the inflators. In some embodiments, oneor more visual indicators are included on the EMA to confirm the abilityof the restraint system to deploy the airbags.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an electronics module assembly (EMA) forcontrolling one or more airbags in accordance with an embodiment of thedisclosed technology;

FIG. 2 illustrates a processor used in an EMA in accordance with oneembodiment of the disclosed technology;

FIG. 3 illustrates a crash sensor and a relay that supplies a voltagesignal to one or more inflators in accordance with an embodiment of thedisclosed technology;

FIG. 4 illustrates an accelerometer included in an EMA in accordancewith one embodiment of the disclosed technology;

FIG. 5 illustrates a battery power source for an EMA in accordance withone embodiment of the disclosed technology;

FIG. 6 illustrates a test circuit for determining if a seat belt buckleis latched in accordance with an embodiment of the disclosed technology;

FIG. 7 illustrates test circuits for testing if wiring and an inflatorfor an airbag are operational and if a battery power source hassufficient power to deploy one or more airbags in accordance with anembodiment of the disclosed technology;

FIG. 8 illustrates a portion of a test circuit that provides a visualindication if the restraint system is operational in accordance with anembodiment of the disclosed technology;

FIG. 9 illustrates a graph of battery voltage versus battery age inorder to determine if a battery power source has sufficient power todeploy one or more airbags in accordance with an embodiment of thedisclosed technology; and

FIG. 10 is a flow chart of steps performed by a processor to deploy anairbag in accordance with an embodiment of the disclosed technology.

DETAILED DESCRIPTION

FIG. 1 is a block diagram of an electronics module assembly (EMA) forcontrolling the deployment of one more personal restraint devices suchas airbag or a seat belt pre-tensioner in an aircraft. Such aircraft canbe commercial airliners, small planes used in general aviation, militaryaircraft including fixed wing aircraft or helicopters. Although thedescription below focuses on the use of the disclosed technology inaircraft, it will be appreciated that the technology could be used inother vehicles such as powered watercraft, passenger trains, subways,busses, school busses etc.

In the disclosed embodiment, a processor 20 is configured to execute aseries of programmed instructions in order to detect a signal producedby a crash sensor 24 in the event of a sudden deceleration. Receipt ofthe signal from the crash sensor causes the processor to create anelectrical path between a power source (e.g. batteries) 30 and aninflator 60 that provides a gas required to inflate an airbag 68 at theappropriate time. In the embodiment shown, the airbag 68 is incorporatedinto a seat belt found on a seat 50. However, the airbag could belocated in other areas such as in a bulkhead or in a monument (e.g.closet, galley, toilet, partition etc.) found in the aircraft.

To help ensure that the crash sensor 24 is not producing an erroneoussignal, the EMA also includes an accelerometer 28 that also produces asignal in the event of a sudden deceleration. In one embodiment, theprocessor 20 looks for signals from both the crash sensor 24 and theaccelerometer 28 to be present before the processor will complete theelectrical path to the inflators 60. The output of the accelerometer 28is provided to an input pin of the processor. The crash sensor output isconnected to an interrupt pin on the processor 20 to cause the processor20 to wake up and begin executing instructions. The instructions causethe processor to sense the voltage at the pin to which the accelerometeris connected to see if a signal indicating a deceleration event ispresent.

In the embodiment shown, a signal from the crash sensor 24 also operatesto close one or more relays 70 that connect one of two voltage levels tothe inflators 60. During a crash event, the relay 70 applies a voltagefrom the power source 30 to the inflators 60. To test the inflators, therelay 70 applies a voltage that is selected to have a value that willnot to fire the inflators. By reading the voltage drop across a circuitpath that includes the inflator, the processor determines if the wiringto the inflator and the inflator itself are functional as will beexplained below.

In one embodiment, the relay(s) 70 is a latch type that will maintain aset or reset configuration until the setting of the relay is switchedelectronically. In one embodiment, the setting of the relay 70 toconnect the power source voltage to the inflators is only performed bythe crash sensor. The processor 20 does not have a connection to placethe relay in a set position so that there is a reduced risk that aprocessor malfunction or an error caused by an electromagnetic pulse orother anomaly could cause an accidental deployment of an airbag.

Because the relay(s) 70 maintain their state, the power source voltagewill remain applied to the inflators until such time as the processorresets the state of the relay(s). This allows the processor more time tocontrol when the airbags are deployed as will be described below. Insome embodiments, two relays are connected in series to connect thevoltage from the power source 30 to the inflators. Having two relays 70in series operates to aid in the prevention of accidental deployment ofan airbag because both relays have to be activated before power isprovided to the inflator. However, it will be appreciated that a singlerelay 70 could be used if a single relay is sufficiently reliable toprevent accidental deployment.

In one embodiment, the power source 30 includes three 1.8 volt lithiumbatteries that are connected in series. A low leakage storage capacitor34 is connected in parallel with the batteries and operates to storesufficient energy to fire the inflators in case one or more of thebatteries becomes drained. In one embodiment, the storage capacitor 34is a low leakage 1.5 farad capacitor. A battery tester circuit 38operates to place the batteries under load so that the processor circuit20 can read the voltage produced as will be explained in further detailbelow. The number of batteries used to power the electronic module couldinclude one or more batteries depending on the voltage produced andtheir expected life. A voltage regulator 40 receives the voltage fromthe batteries and produces a well-regulated voltage that is used by theprocessor as a reference for its analog to digital converters and atother places in the electronic module assembly.

Before an inflator associated with a passenger seat belt airbag isfired, a buckle latch detector circuit 90 determines if a seat beltbuckle is latched. If the buckle is not latched, the inflator is notfired. In one embodiment, the buckle latch detector circuit 90 employs aHall effect sensor to detect when the buckle is latched. In anotherembodiment, a glass-enclosed reed switch can be incorporated into thebuckle. The Hall effect sensor or the reed switch changes state whenplaced in proximity with a magnet that is placed in the other half ofthe buckle. As will be explained below, by selectively powering the Halleffect sensor and the circuitry to read the sensor only during a crashevent or during a self-test routine, battery power is conserved.

A self-test control circuit 120 is provided with a push button switch orother user activated device (RFID, Bluetooth receiver, IR receiver etc.)that when activated, causes the processor process instructions to testthe readiness of the EMA to deploy the airbags. In one embodiment, lightemitting diodes on the self-test control circuit 120 are illuminated bythe processor 20 to indicate if the EMA is operable (e.g. green LED) orinoperable (e.g. red LED).

FIG. 2 shows connections made to a suitable processor for controllingthe EMA. In one embodiment, the processor is a PIC16F883-I/PTmicrocontroller that draws very little current during a sleep mode inorder to increase the life of the power source 30. In one embodiment,the processor 20 is only active during a crash event or during aself-test mode. At other times, the processor is operating in a sleepmode where it can respond to interrupts but is otherwise inactive. Inone embodiment, the processor 20 has one or more built in analog todigital converters for reading voltages produced within the EMA. Inaddition, the processor has one or more timing circuits that can be usedto time output signals for firing airbag inflators. The processor alsohas the ability to read the value of the supply voltage used to powerthe processor and compare it to a reference voltage produced by thevoltage regulator 40 and supplied between processor pins Vref+ andVref−.

FIG. 3 shows more detail of the crash sensor 24 and the relay 70 thatoperates to connect the voltage from the power source 30 to theinflators 60 in the event of a sudden deceleration. In one embodiment,the crash sensor 24 is a spring operated device that operates to move amagnet over a pair of reed switches when the magnet is moved by theforce of the deceleration. In one embodiment, the connections to pins 1and 2 of the crash sensor are grounded when the crash sensor isactivated. Pin 2 is connected to an interrupt pin on the processor 20 toalert the processor to a crash event. Pin 1 is connected to a S− pin onthe relay 70. Grounding the S− pin causes the relay 70 to move to a setstate in which Vdd from the power source 30 (on pin 7 of the relay) isconnected to an inflator input (INF+) terminal of the inflators 60. Toreset the relay, a pair of transistors Q7 and Q8 are connected in seriesbetween pin 6 of the relay (R−) and ground. When the transistors Q7 andQ8 are triggered by a Relay-Reset signal from the processor 20, the R−pin of the relay 70 is grounded and the relay is reset and the voltageVdd from the power source is removed from the inflators.

To test the operation of the relay, a voltage with a magnitude selectedto be less than the value required to fire the inflators is supplied topin OR2. Because the relay internally connects pin O2R to pin C2, thereduced voltage level appears on the same output pin C2 on which thevoltage Vdd appears in the event of a crash. The processor 20 can sensethe voltage on pin C2 using a transistor Q12 connected between pin C2and ground through a resistor R48. In one embodiment, the reducedvoltage is supplied when a transistor Q4 is enabled between the powersource 30 and pin 02R of the relay through a resistor R4. Whentransistors Q4 and Q12 are turned on, a current path is created toground and the voltage at pin C2 will be determined by the relativesizes of the two resistors R4 and R48 in series. In one embodiment, theprocessor is able to detect if the relay is operating properly by thevoltage detected on output pin C2.

As indicated above, the EMA includes an accelerometer 28 that is used inconjunction with the crash sensor to determine if a crash event isoccurring. FIG. 4 shows one embodiment of the accelerometer 28. In theembodiment shown, pin 1 of the accelerometer is connected to Vdd and pin2 is connected to a parallel combination of a capacitor C5 and aresistor R11. The accelerometer is aligned in the most likely directionof a deceleration event in the aircraft. When no deceleration isoccurring, the voltage on pin 2 is zero volts and when the accelerometeris active during a deceleration event, the Vdd is applied to pin 2 andthe voltage on pin 2 rises according to the RC time constant. Thevoltage on pin 2 is supplied to an input pin on the processor so thatwhen the processor is awakened by an interrupt caused by the crashsensor, the processor checks the voltage on pin 2 of the accelerometerto confirm that a deceleration event is really occurring. The capacitorholds an increased voltage even if the accelerometer resets inaccordance with the RC time constant.

FIG. 5 shows additional detail of the power source 30. In oneembodiment, the power source comprises three AA battery cells connectedin series that are selected to have a 10 year useful life. Whenconnected to the storage capacitor 34, the power source 30 and capacitor34 have sufficient energy to fire the inflators for an additional year.The batteries 32 are connected to the storage capacitor 34 through asocket 36. A jumper pin (not shown) is placed into the socket 36 toconnect the batteries in parallel with the storage capacitor 34. In oneembodiment, the jumper pin is secured by a portion of a housing of theEMA to prevent it from coming loose. The jumper pin is placed into thesocket 36 at the time the EMA is installed to prevent premature powerdrain on the batteries. A battery pack connector socket 35 provides aconnection of the batteries 32 to the printed circuit board of the EMA.

In one embodiment of the disclosed technology, each EMA is able to fireup to three inflators. These inflators can be assigned to threedifferent seats (one inflator/airbag per seat) or a single seat may usemultiple inflators (multiple airbags per seat) or multiple inflators maybe used on a single airbag (one to inflate and another to over inflatethe airbag e.g. cause it to burst). Other locations for the airbagscould be in bulkheads or in monuments etc. Of course, a greater orlesser number of channels could be provided in each EMA.

FIG. 6 shows one embodiment of a buckle latch detection circuit 90. Inthe embodiment shown, the buckle latch detection circuit is able todetermine if a seat belt buckle is latched regardless of whether thereis a reed switch or a Hall effect sensor in the seat belt buckle. TheEMA is configured at the time of installation or manufacture by placinga number of jumpers in the circuit depending on which type of switch isto be used. FIG. 6 shows circuitry for testing the buckle condition ofone seat. However it will be appreciated that this circuitry can berepeated in the EMA for each channel.

A socket J1 is used to connect two wires that connect to a switch(represented as 92) found in the seat belt buckle. In one embodiment,the switch 92 is a normally closed switch (e.g. closed when the seatbelt is not latched). If a reed switch is used in the buckle that isactivated by a magnet in a mating part of the buckle, the latchdetection circuit includes jumpers JP02 and JP03 that connect to thewires leading to the switch. Resistor R31 is connected between jumperJP02 and a node 93. Resistor R35 is connected between jumper JP03 andground. A capacitor C19 is connected between the node 93 and ground. Aresistor R36 is connected between node 93 and ground. Resistors R31,R35, R36 and capacitor C19 are provided for high intensity radiofrequency (HIRF) protection of the circuitry. A jumper J01 is connectedbetween the node 93 and an input pin labelled AS1 (assigned seat 1) onthe processor. The voltage at node 93 is read by the processor toindicate whether the seat belt switch 92 is open or closed. If theswitch is closed (e.g. the buckle is not latched) then the voltage atnode 93 will be approximately 0 volts. If the switch is open (e.g. thebuckle is latched) then there is an open circuit created and the voltageat node 93 will be approximately Vdd as supplied by a pull up resistorinternal to the processor.

In some environments, reed switches are prone to breaking and thereforea more robust Hall effect sensor is used to detect the latching of thebuckle. One problem with a Hall effect sensor is that it must be poweredto work. In the disclosed embodiment, the circuitry in the buckle latchdetection circuit 90 is configured to only provide power to the Halleffect sensor during a crash event or during a self-test cycle to avoidunduly draining the power source 30.

If a Hall effector sensor is used, jumpers JP01, JP02 and JP03 areremoved and jumpers JP10, JP11 and JP12 are installed. Jumpers JP11 andJP12 connect a comparator circuit to the wires that extend to and fromthe Hall effect sensor in the buckle. One wire supplies Vdd from thepower source to the sensor (not shown) through a parallel combination ofresistor R42 and capacitor C29 that are provided for HIRF protection.The other wire that is connected to the Hall effect sensor is connectedthrough jumper JP11 and a resistor R45 to a positive input of acomparator circuit U3C. Comparator circuit UC3 is powered by voltage Vddat its V+ input and is connected to an intermediate ground pointlabelled GND 1 at its V− input. Connected between one side of resistorR45 and the intermediate ground GND 1 is a parallel combination ofresistor R46 and capacitor C50. Connected between the other side ofresistor R45 (at the positive input of the comparator) and theintermediate ground GND 1 is a capacitor C31. Resistor R46 and capacitorC30 and resistor R45 and capacitor C31 provide a low pass filter forHIRF protection for the non-inverting of the comparator.

Connected to the inverting input of the comparator U3C is a fraction ofreference voltage produced by the voltage regulator 40 (e.g. a fractionof 3.3 volts in the embodiment shown). The fractional voltage is takenat a resistor divider formed by the series connection of resistors R29and R43 connected between the reference voltage and the intermediateground GND 1. Connected between the junction of resistors R29 and R43and the inverting input of the comparator is a resistor R32. Connectedbetween the inverting input and the intermediate ground GND 1 is acapacitor C28 that have the same values as resistor R45 and capacitorC31 and form a low pass filter for HIRF protection at the invertinginput.

To avoid unnecessary power draw from the power source, the intermediateground GND 1 is connected to circuit ground through a transistor Q11that is turned with a signal READ from the processor. Therefore, theHall effect sensor circuit does not operate or supply power to the Halleffect sensor unless instructed by the processor.

With the transistor Q11 turned on, the comparator circuit determines ifthe buckle is latched or not. If the buckle is not latched, the Halleffect sensor creates a circuit path between the supply voltage Vdd andthe non-inverting input of the comparator U3C, causing the comparatorUC3 to produce a high output of approximately Vdd. If the buckle islatched, then the Hall effect sensor creates an open circuit and thevoltage applied to the inverting input of the comparator is larger thanthe voltage applied to the non-inverting input and the comparatorproduces a low output of approximately 0 volts. The output voltage ofthe comparator is connected to an input of the processor so that theprocessor can determine if the buckle is latched or not. FIG. 7 showsadditional detail of one embodiment of an inflator test circuit 110 thatis used to test the integrity of the wires leading to the inflators anda squib that is part of the inflator itself. Although one test circuitis shown, the EMA includes test circuits for each channel that iscontrolled by the EMA. The test circuit 110 includes a transistor Q1having a gate that is connected to an output pin of the processorthrough a resistor R36. A capacitor C12 is connected between the gateand ground. The resistor R36 and capacitor C12 provide a low pass filterfor HIRF protection so that the transistor Q1 is not accidently turnedon by stray electromagnetic energy. The drain of transistor Q1 at a node112 is connected to a wire that is in line with the inflator. Connectedbetween the node 112 and ground and that is parallel with source/drainof the transistor Q1 is a resistor R5. The resistor R5 forms a secondcurrent path around the transistor Q1 to conduct current when thetransistor is turned off. A resistor R18 is connected between the node112 and an analog to digital converter input of the processor 20.Reading the voltage at node 112 provides an indication of the integrityof the wires leading to the inflator and resistance of the squib.

In accordance with one embodiment, the processor first reads the voltageat node 112 to test the inflator. With no voltage applied to theinflator, the voltage at node 112 should be approximately 0 volts. Theprocessor then applies a relay-reset signal to the relay 70 and thenapplies a test-enable signal to transistor Q4 (FIG. 3) to apply aportion of Vdd to the +INF wire leading to the inflator. The voltage atnode 112 is then proportional to the value of resistor R5 compared tothe sum of resistors R4 (at the relay 70) and R5 and the resistance ofthe squib (nominally 2 ohms). The processor reads the fraction of Vdd atnode 112 with transistor Q4 turned on. Once the processor has determinedthat the voltage at node 112 is as expected and is low enough not tofire the squib, the processor can turn on the firing transistor Q1 andbypass the resistor R5. The voltage read at node 112 with the transistorQ1 turned on can then be used to further estimate the resistance of thesquib. If the voltages read are in a range that is expected, then theprocessor determines that inflator and wires leading to and from thesquib are operable. If the voltages are not as expected, the processorcan signal a fault condition (e.g. through the red LED).

To fire the inflator, the processor applies a signal to the gate oftransistor Q1 at the appropriate time. A current path is then createdfrom the +INF line to ground through the transistor. If the voltageapplied to the +INF line is Vdd from the relay 70, the current flowingto the inflator is sufficient to fire the squib.

FIGS. 7 and 9 show additional details of the battery test circuit 38shown in FIG. 1. The battery test circuit includes a transistor Q9having a gate that is controlled from an output pin labelledbattery-test on the processor 20. A resistor R41 is connected betweenthe pin on the processor and the gate of transistor Q9 and a capacitorC20 is connected between the gate of transistor Q9 and ground. ResistorR41 and capacitor C20 provide a low pass filter for HIRF protection toprevent the transistor from being activated by stray electromagneticfields. The drain of transistor Q9 is connected to the supply voltageVdd through a resistor R66. Turning on the transistor Q9 with a signalfrom the processor causes a current from the batteries and supplycapacitor 34 to flow through resistor R66 in order to place thebatteries under load. The voltage Vdd will then drop to the voltage thatcan be supplied by the batteries 30. The processor 20 has the ability tomeasure the level of voltage Vdd supplied to the processor compared withthe regulated voltage supplied by the voltage regulator 40.

In one embodiment, the voltage produced by the batteries isapproximately 5.5 volts if the batteries are fresh, 4.25-4.5 volts ifthe batteries are low and below 3.2 volts if the batteries areconsidered dead. FIG. 9 shows an example of battery voltage versus ageas a line 150. Placing the batteries under load causes a brief reductionin the voltage Vdd that is detected. If the detected Vdd voltage dipsbelow the value determined for a dead battery (point 152) then theprocessor will provide an alert (visual, audible, RF signal or the like)indicating that the EMA may not operate to fire the inflators.

FIG. 8 shows an embodiment of a connector found on the enclosure of theEMA that allows the processor to receive a signal to cause the processorto perform a self-test routine. In one embodiment, a pushbutton switch(not shown) is provided to momentarily ground pin 4 of the connectorwhich is normally held at Vdd. Pin 4 of the connector is connected to aninterrupt pin on the processor through a resistor R30. A capacitor C6 isconnected between pin 4 of the connector and ground. Resistor R30 andcapacitor C6 are provided for HIRF protection. Grounding pin 4 causes asignal to be provided to an interrupt pin on the processor that in turncauses the processor to begin the self-test routine. Pins 2 and 3 of theconnector provide power to two LEDs (red, green) that the processor canilluminate with a signal from a pair of output pins. Each output pin isconnected to the LEDs through resistors R7 and R8. Capacitors C7 and C8are connected between the pins 2 and 3 on the connector and ground forHIRF protection.

In the embodiment described above, the processor stores parameters forhow the airbags should be deployed for a given seat configuration. Forexample, some seats may contain a single airbag fired with one inflator.Some seats may include an airbag with two or more inflators (e.g. onefor inflation and one to over inflate and burst the airbag). Some seatsmay be equipped with multiple airbags (e.g. head and knee airbags) orone or more airbags and a seatbelt pre-tensioner. Other configurationsmay place the airbags in a bulkhead or monument near the passenger seat.In some embodiments, the processor 20 is programmed to determine if thedeployment of an airbag requires that a seatbelt buckle be latchedbefore the inflators should be fired. In the past, RC delay circuitswere used to determine the firing delays after the receipt of the signalfrom the crash sensor but a single EMA design could not accommodate allthe combinations of seat/airbag configurations. In addition, RC timedelay circuits were susceptible to HIRF interference. Typical delaytimes range from 40-250 milliseconds after a crash event. In addition,typically delay times for overinflating an airbag are from 20-40milliseconds after the bag is inflated. Using the processor to controlthe firing times allows the timing to be fine-tuned for a variety ofseat configurations. If a pre-tensioner is used, the pre-tensioner canbe fired before the airbag that is associated with the seat is fired.

In one embodiment, the processor stores timing values in its memory foreach of the three channels that can fire an inflator. In addition, thememory can indicate whether the channel is associated with a seat beltbuckle that should be checked for latching before the inflator can befired. When the processor is alerted to a crash event, the processorreads a memory location (e.g. a register) associated with each channelto determine whether or not to check a seat belt buckle and for a timingvalue of when to fire the inflator.

FIG. 10 is a flow chart showing logic performed by the processor inaccordance with one embodiment of the disclosed technology. Although thesteps are described in a certain order for ease of explanation, it willbe appreciated that the steps could be performed in a different order orthat different steps could be performed in order to achieve thefunctionality described.

Starting at 200, the processor is alerted to a crash event by aninterrupt signal received from the crash sensor. At 205, the processoris awakened and begins an interrupt routine and starts an internaltimer. At 210, the processor determines if the accelerometer isproducing a signal indicating a deceleration event. If so, processingproceeds to 220. Otherwise processing ends at 215.

At 220, the processor reads the memory for one or more firing parametersassociated with each channel. At 225, the processor processes theparameters for each channel. At 230, the processor determines if thememory indicates that there is a seatbelt buckle that is required to belatched before the inflator can be fired for that channel. If so, theprocessor enables the buckle latch detector circuit for the buckle at235 and determines at 240 if the corresponding buckle is latched. If theseat belt buckle is latched, then processor determines if the timervalue set for the channel is met by the timer that was started when thecrash event was detected. If so, the inflator for the channel is firedat 255. If the timer value is not yet met, processing returns to 250until the timer value is met.

If the answer at 230 is no and the channel is not required to have abuckle that is latched before firing the inflator, then processingproceeds to 260 to determine if the timer value set for the channel ismet by the timer that was started when the crash event was detected. Ifso, the inflator is fired at 255. If the timer value is not yet met,processing returns to 260 until the timer value is met. In oneembodiment, once the inflators are fired the processor places the one ormore relays in a reset position.

Embodiments of the subject matter and the operations described in thisspecification can be implemented in digital electronic circuitry, or incomputer software, firmware, or hardware, including the structuresdisclosed in this specification and their structural equivalents, or incombinations of one or more of them. Embodiments of the subject matterdescribed in this specification can be implemented as one or morecomputer programs, i.e., one or more modules of computer programinstructions, encoded on computer storage medium for execution by, or tocontrol the operation of, data processing apparatus.

A computer storage medium can be, or can be included in, acomputer-readable storage device, a computer-readable storage substrate,a random or serial access memory array or device, or a combination ofone or more of them.

The term “processor” encompasses all kinds of apparatus, devices, andmachines for processing data, including by way of example a programmableprocessor, a computer, a system on a chip, digital signal processor(DSP) or multiple ones, or combinations, of the foregoing. The apparatuscan include special purpose logic circuitry, e.g., an FPGA (fieldprogrammable gate array) or an ASIC (application-specific integratedcircuit).

A computer program (also known as a program, software, softwareapplication, script, or code) can be written in any form of programminglanguage, including compiled or interpreted languages, declarative orprocedural languages, and it can be deployed in any form, including as astand-alone program or as a module, component, subroutine, object, orother unit suitable for use in a computing environment.

The processes and logic flows described in this specification can beperformed by one or more programmable processors executing one or morecomputer programs to perform actions by operating on input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, e.g., an FPGA (field programmable gate array) or an ASIC(application-specific integrated circuit).

Devices suitable for storing computer program instructions and datainclude all forms of non-volatile memory, media and memory devices,including by way of example semiconductor memory devices, e.g., EPROM,EEPROM, and flash memory devices. The processor and the memory can besupplemented by, or incorporated in, special purpose logic circuitry.

From the foregoing, it will be appreciated that specific embodiments ofthe invention have been described herein for purposes of illustration,but that various modifications may be made without deviating from thescope of the invention. Accordingly, the invention is not limited exceptas by the appended claims.

I/we claim:
 1. An electronic module assembly for controlling the deployment of one or more airbags in a vehicle, comprising: a power source; a crash sensor configured to produce a signal in response to a crash event; an accelerometer that is configured to produce a signal in response to a crash event; a processor configured to receive the signals from the crash sensor and the accelerometer, wherein the processor is configured to: start a timer upon detection of the signal from the crash sensor; determine if a signal has been received from the accelerometer indicating the occurrence of the crash event; if signals from both the crash sensor and the accelerometer indicate a crash event then read a timing value selected for an inflator in a memory associated with the inflator; determine if the timer has a value equal to the timing value selected for the inflator; and produce a signal to fire the inflator when the timer has a value equal to the timing value selected for the inflator.
 2. The electronic module assembly of claim 1, wherein the processor is further configured to: read a value from the memory associated with the inflator to determine if a status of a seat belt buckle needs to be determined before firing the inflator and if so, determining the status of the seat belt buckle before producing the signal to fire the inflator.
 3. The electronic module assembly of claim 2, further comprising a seat belt latch detection circuit including: a circuit to direct power from the power source to a Hall effect sensor; a comparator for comparing a signal from the Hall effect sensor against a known voltage to determine if a seat belt buckle is latched; wherein the processor is configured to control when the latch detection circuit delivers power to the Hall effect sensor and when the comparator is powered to determine if the seat belt buckle is latched.
 4. The electronic module assembly of claim 3, wherein circuit for directing power to the Hall effect sensor and the comparator are connected to an intermediate ground and the processor is configured to connect the intermediate ground to a ground shared by the power source of the electronic module assembly in order to direct power to the Hall effect sensor and to power the comparator.
 5. The electronic module assembly of claim 1, further comprising a relay that is set to provide power to an inflator by a signal from the crash sensor.
 6. The electronic module assembly of claim 5, further comprising a transistor in series with the inflator that is controlled by the processor to complete a current path from the relay and though the inflator in order to fire the inflator.
 7. The electronic module assembly of claim 5, wherein the relay is configured to apply a voltage to the inflator having a value that is not great enough to fire the inflator and the transistor that fires the inflator is bypassed with a resistor, wherein the processor is configured to read a voltage at the bypassing resistor when the voltage applied to the inflator is not great enough to fire the inflator is in order to determine if the inflator is operable.
 8. The electronic module assembly of claim 1, wherein the power source includes one or more batteries, further comprising: a power source testing circuit that is controlled by the processor to place a load on the one or more batteries and to read a voltage produced by the batteries when under the load. 